CI programme R1: build or restore the compiler pair once per run (seed job)

[gunbai-bot]

Measured runner-minutes (this PR's run on a878bd6 vs baseline run 37501346261)

job	baseline	this PR
seed (new: builds/restores the pair once)	-	5.3
rust-unit-tests	5.9	7.0
emit-build (still builds its own gunbc; fault experiment unchanged)	51.6	45.8
generated	19.4	14.6
floor	41.1	34.6
witnesses	0.1	0.1
total	118.1	107.4

Honest reading: this PR alone saves ~10 runner-minutes, nowhere near the 29-minute target. floor and generated now restore the verified pair (no cargo build) but this was a cache-miss run for the pair key (seed built it, 5.3 min), so the restore win is the consumers' skipped build, not a hit. The big remaining cost is emit-build (own build + native fault-and-restoration experiment) which is R2/R4 and not in this PR; emit-build keeps its self-build until the gunbc test freshness guard gets the same typed provenance arm. Memo/hit counters for a keyed hit run are not yet measured (needs a second run on an unchanged tree).

R1 of docs/plans/ci-end-to-end-accounting.md (programme 1). Adds a seed job to the generated witnesses workflow that keys the compiler pair via gunbc.fleet_release_bins_key (compiler_pair_release_product), looks it up in the existing cache mechanism, builds only on a miss, and hands the verified pack to floor, generated and emit-build. Each consumer verifies the pack against the seed's key and promotes it into its own checkout's target/release, so native probe isolation is unchanged. The merge-group candidate artifact moves from floor to seed. seed is a blocking lane in the aggregate.

Status: ready for review. R1 (seed job, keyed pair restore into private dirs, typed checker-inputs sidecar) is measured below. R2, R4, R5 and R6 follow in separate PRs.

Hand-written seed Rust receipt

write_checker_inputs_record, the sidecar reader in checker_dependency.rs and the --write-checker-inputs arm in claim_executor extend the seed's existing dep-info reader (observe_checker_input_paths); they add no new capability to v1, only a second typed source for the same fact so a verified restored pair can run the floor. Dissolution: when the floor's checker-subject decision is carried as a typed artifact from the seed job (parent ruling msg_ba78077c, follow-up), the sidecar reader and this arm are deleted. Operator sign-off for the seed job: roster change authorised in the work item node://adhoc-2a3c0585-9e8 (operator direction 2026-10-06).

🤖 Generated with Claude Code

[gunbai-bot]

Re the sign-off question: the new seed job is covered by the operator's 2026-10-06 direction for the CI programme. It is recorded on work item node://adhoc-2a3c0585-9e8, which says the operator authorizes changing the required job roster. The accounting plan, docs/plans/ci-end-to-end-accounting.md, is on PR #13505 (branch session/swift-bat-828) and is not on main yet. The before/after runner-minutes will go in this PR body once the first run on this head finishes.

— sent from snappy-ibex-32